Patient Reviews: How Practices Earn More and Reply Safely

Before a new patient books, they almost always read what other patients say. Reviews tell them things a practice website can't: whether the front desk is kind, whether the wait is reasonable, whether the doctor listens. For medical and dental practices, patient reviews are also unusually tricky. The rules on asking for them, the platforms that host them and the privacy law that governs how you reply are all stricter than for a pizza shop or a plumber.

This guide covers how practices can earn more patient reviews honestly and respond without putting patient privacy at risk.

Where patients read reviews

Google is usually the first place, because star ratings appear right next to your practice in search results and on Maps. Patients also check health-specific directories, insurance company "find a doctor" tools and, for some specialties, social media. You can't be everywhere, so focus your requests on Google and the one or two directories that matter most in your specialty, and make sure your profile on each is claimed and accurate.

Asking for reviews the right way

Ask everyone, not just the happy ones

Google's policies for reviews say businesses must not discourage or prohibit negative reviews or selectively solicit positive ones. That rules out "review gating," where you send a survey first and only ask satisfied patients to post publicly. Send the same request to every patient after a visit. Most patients who had a good experience will be glad to help, and the occasional critical review gives you a chance to show how you handle concerns.

Never pay for, or script, the result

The Federal Trade Commission's rule on consumer reviews and testimonials, announced in August 2024, prohibits fake reviews, buying reviews that are conditioned on a particular sentiment, undisclosed reviews from insiders like staff or family, and using threats or intimidation to suppress negative reviews. For a practice, the safe approach is simple: no gift cards, discounts or raffle entries in exchange for reviews, no reviews written by employees, and no pressure.

Keep the request free of health details

A review request should be short and generic: "Thanks for visiting Lakeside Family Medicine. If you have a minute, we'd love to hear about your experience," followed by a link. Don't mention the procedure, condition or provider specialty in the message, and send it through a channel the patient has agreed to receive messages on.

Time it well

The best moment is shortly after a positive visit: a text the same afternoon usually gets more responses than an email a week later. One reminder a few days later is plenty. If you'd like more examples of wording and timing, see how to get more Google reviews without being pushy.

Replying without violating HIPAA

This is where well-meaning practices get into trouble. When a patient posts a complaint, the instinct is to explain what really happened. Doing so can disclose protected health information, even if the patient shared details first.

The U.S. Department of Health and Human Services has settled more than one case over exactly this. In 2019, a Texas dental practice paid $10,000 after responding to online reviews in ways that disclosed patients' information, including treatment and insurance details. In 2022, HHS announced a $23,000 settlement with New Vision Dental in California over disclosures made while replying to online reviews, and stated that providers cannot disclose patients' protected health information when responding to negative online reviews.

Safe replies have a few things in common:

• They never confirm that the reviewer is, or was, a patient.
• They never mention a diagnosis, treatment, appointment date, provider, bill or insurance.
• They thank the person, state the practice's values in general terms and invite them to call the office manager directly.

Examples you can adapt:

• Positive review: "Thank you for the kind words. Our team works hard to make every visit a good one, and we appreciate you taking the time to share."
• Negative review: "We take feedback seriously and want everyone who contacts us to have a good experience. Please call our office manager at the main number so we can talk this through privately."

Notice what's missing: no "we're sorry your crown didn't fit," no "our records show," no first name of the doctor involved.

When a review is false or abusive

Sometimes a review is plainly fake, from someone who was never seen, or contains harassment. Don't argue in public. Use the platform's reporting tools to flag reviews that break its policies, and keep a record of what you flagged and when. If a review contains threats or another patient's information, report it promptly. Avoid legal threats against reviewers, which can backfire publicly and may run into the FTC rule's limits on review suppression.

Put it in a written policy

HHS has noted in its enforcement actions when practices lacked policies on disclosures through social media and reviews. A one-page policy protects the practice and makes the right behavior easy for staff:

• Who is allowed to reply to reviews, and who approves replies
• The approved reply templates and what must never be included
• How and when patients are asked for reviews, with no incentives
• How to flag fake or abusive reviews
• Training for new staff and a yearly refresher

Make asking for reviews routine

The practices with the strongest reputations don't run occasional review drives. They send every patient the same simple request after every visit, reply to every review within a few days using approved language and check their profiles weekly. Over a year, that steady habit builds a review profile that speaks for the practice better than any ad.

How Venn can help your practice

On the Growth plan ($497 a month), Venn sends review requests to patients by text after their visit, using a short, general message your practice approves. When reviews arrive, we draft replies for your team to approve, and nothing posts until you approve it, so you can keep every reply general. Growth also includes AI SEO, Google posts and four blog posts a month. Every Venn plan, starting with Essential at $79 a month, includes a managed website, a business CRM, a business phone number and missed call text back. Your practice remains responsible for its own HIPAA compliance. See how Venn works with healthcare practices or compare plans on our pricing page.

Sources and further reading

• HHS Office for Civil Rights Settles HIPAA Investigation of New Vision Dental, U.S. Department of Health and Human Services
• Dental practice pays $10K to settle complaint it disclosed patient information on Yelp, Fierce Healthcare
• Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials, Federal Trade Commission
• Maps user-contributed content policy, Google